#ifndef _RULE_H_
#define _RULE_H_
#include <Ntifs.h>
#include <ntddk.h>
#include <ntstrsafe.h>
#include "NtCommon.h"
#include "hash.h"

typedef enum _OpType
{
	NET_OP,
	NET_OP_TRAVERSE,
	PROC_OP,
	REG_OP,
	FILE_OP,
	DRIV_OP,
}OpType;

#define OPTION_TO_JUGE 1

#define	RESULT_PERMIT		1
#define	RESULT_STOP			2
#define	RESULT_TO_USER		3



typedef struct _PATH_NODE
{
	long 	key;
	WCHAR	path[MYMAXLEN];
}PATH_NODE, *PPATH_NODE;


typedef struct _PATH_RULE_NODE
{
	ULONG		index;
	WCHAR		path[MYMAXLEN];
} PATH_RULE_NODE, *PPATH_RULE_NODE;

typedef struct _HIPS_RULE_NODE
{
	UCHAR		major_type;
	UCHAR		minor_type;
	UCHAR		result;
	UCHAR		isDir;
	DWORD		key;
	HANDLE		src_pid;
	HANDLE		des_pid;
	WCHAR		src_path[HIPS_PATH_LEN];
	WCHAR		des_path[HIPS_PATH_LEN];
} HIPS_RULE_NODE, *PHIPS_RULE_NODE;

typedef struct _HIPS_NET_NODE
{
	WCHAR		protocol[10];
	HANDLE		src_pid;
	WCHAR		src_path[HIPS_PATH_LEN];
	ULONG		remotePort;
	ULONG		localPort;
	WCHAR		remoteIp[30];
	WCHAR		localIp[30];
	
} HIPS_NET_NODE, *PHIPS_NET_NODE;

typedef struct _USER_DATA
{
	UCHAR		option;
	union
	{
		HIPS_NET_NODE net_node;
		HIPS_RULE_NODE rule_node;
	};
} USER_DATA, *PUSER_DATA;

BOOLEAN load_path_rule(PHASHTABLE pHash, WCHAR* pRegPath);
BOOLEAN insert_hips_rule(PHASHTABLE pHash, HIPS_RULE_NODE* hips_node);
BOOLEAN insert_path_node(PHASHTABLE pHash, PATH_NODE* path_node);
NTSTATUS delete_hips_rule(PHASHTABLE pHash, HIPS_RULE_NODE* hips_node);
NTSTATUS delete_hips_rule_by_key(PHASHTABLE pHash, DWORD key);
NTSTATUS delete_path_node_by_key(PHASHTABLE pHash, DWORD key);
BOOLEAN match_hips_rules(PHASHTABLE pHash, HIPS_RULE_NODE* hips_node, PUCHAR pRet);
BOOLEAN match_single_hips_rule(HIPS_RULE_NODE* hips_patt, HIPS_RULE_NODE* hips_node);
BOOLEAN is_path_in_table(PHASHTABLE pHash, PUNICODE_STRING pPath);


#endif